Binance Raises Coverage of $6.3 Billion Hack Losses to 95%

Key Facts

Binance said its hot wallets were hacked at about 20:05 UTC on October 29, estimating the value of the stolen tokenized assets at about $6.3 billion. The company said it had allocated more than $6.34 billion of its own funds to cover the affected amount, stressing that users would not bear the cost. In a November 1 update, it said it had covered about 95% of the amount, up from 90% in the previous update. It said the remaining 5% involved less liquid tokens outside the top ten assets mentioned. It set the start of the first phase of resumed withdrawals for that day between 06:00 and 09:00 UTC, with networks and assets to be made available gradually.

The figures disclosed distinguish between funds frozen by external entities and funds Binance said it had allocated to cover the affected assets. TRM estimated that stablecoin issuers froze about $2.67 billion, while the Arbitrum Security Council froze about 8,426 ETH and 74.6 million ARB. Total on-chain frozen assets stood at about $2.7 billion as of 00:30 UTC on October 30, according to the research firm. The freezes included about $1.77 billion in USDT at Tether and about $825 million in USDC at Circle. TRM also said Binance’s total transfers amounted to about $6.36 billion, showing that the value of frozen assets remained below the value that left the wallets.

TRM estimated that attackers moved about $6.36 billion from Binance wallets across ten blockchain networks, with most transfers concentrated over about 20 minutes starting at 20:05 UTC. The research firm broke down the estimate into about $3.79 billion on Ethereum, about $1.47 billion on Bitcoin and about $628 million on Tron. On Ethereum, the report said the attacker used an EIP-7702 delegation to turn a hot wallet into a controlled withdrawal tool, after preparing 50 pre-signed delegations. TRM said preparations began at least 36 hours before the theft, with small withdrawals from Tornado Cash to fund an operational wallet. The firm said most of the funds moved quickly, but the operation was preceded by a longer preparation phase.

Binance’s initial explanation of how the hack occurred said the incident may have begun with the compromise of a DevOps engineer’s laptop, which enabled access to a service container and the sending of unauthorized withdrawal transactions. The company added: "We found no evidence that the private keys for any wallet were leaked." But in a later update, it said the investigation had uncovered additional points of compromise and that it had not yet established the full sequence of the attack. The company thus moved away from relying solely on its initial account linking the incident to the engineer’s laptop, without publishing a definitive root cause as of its November 1 update. Binance said it would publish an incident report after the investigation was complete.

On attribution, TRM said it had attributed the attack with high confidence to TraderTraitor, which it described as a North Korean hacking unit. The Associated Press reported that the U.S. Federal Bureau of Investigation linked the attack to the group’s malicious cyber activity and asked cryptocurrency platforms and others to block transactions tied to the attackers’ addresses. The bureau linked the same group to the $1.5 billion Bybit theft in 2025. It said TraderTraitor was converting the stolen assets primarily into Ethereum and that it expected subsequent conversion attempts through decentralized finance and instant-swap services. The attribution comes as Binance said its investigation was ongoing.

The hack coincided with a 3.2% drop in Bitcoin on the evening of Thursday, October 29, to below $79,000, according to the Associated Press. The currency’s daily close was $77,991.89 on October 29 and then $77,368.77 on October 30, according to EL7 data. Binance announced a gradual resumption of withdrawals after suspending them for security checks, while its update said networks and assets would continue opening in sequence during the first phase. The company says its coverage rate rose from 80% to 90% and then 95% in successive updates. The report it promised to publish after the investigation is complete remains the next announced milestone in tracking the incident’s details.